[Paper Review] Regulating Ownership Verification for Deep Neural Networks: Scenarios, Protocols, and Prospects

Fangqi Li, Shilin Wang+1 more|arXiv (Cornell University)|Aug 20, 2021

Adversarial Robustness in Machine Learning23 references4 citations

TL;DR

This paper proposes three novel ownership verification protocols for deep neural networks (DNNs) tailored to real-world scenarios: ownership proof, federated learning, and intellectual property transfer. It identifies new security requirements beyond traditional watermarking, evaluates five existing schemes against these, and finds that no current scheme satisfies all protocol-specific demands, highlighting the need for next-generation watermarking designs with enhanced robustness, covertness, and adaptability to diverse deployment contexts.

ABSTRACT

With the broad application of deep neural networks, the necessity of protecting them as intellectual properties has become evident. Numerous watermarking schemes have been proposed to identify the owner of a deep neural network and verify the ownership. However, most of them focused on the watermark embedding rather than the protocol for provable verification. To bridge the gap between those proposals and real-world demands, we study the deep learning model intellectual property protection in three scenarios: the ownership proof, the federated learning, and the intellectual property transfer. We present three protocols respectively. These protocols raise several new requirements for the bottom-level watermarking schemes.

Motivation & Objective

• To address the gap between existing DNN watermarking schemes and real-world deployment needs by formulating protocols for practical ownership verification scenarios.
• To identify and formalize new security requirements for watermarking schemes arising from specific deployment contexts such as federated learning and IP transfer.
• To evaluate existing watermarking schemes (Uchida’s, Rand, WF, ATGF, MTL-Sign) against these new requirements in terms of robustness, covertness, and efficiency.
• To demonstrate that current watermarking schemes fall short in satisfying all protocol-specific security properties simultaneously, especially under conflicting demands like watermark capacity and model integrity.
• To advocate for future research in designing watermarking schemes that meet the multifaceted and sometimes contradictory requirements of modern DNN IP protection.

Proposed method

• Proposes three distinct ownership verification protocols: (1) white-box ownership proof with a trusted sponsor, (2) black-box verification in API-based services, and (3) decentralized verification in federated learning settings.
• Introduces five new security metrics to evaluate watermarking schemes under protocol-specific constraints: (A) spoil attack resilience, (B) watermark capacity, (C) robustness to fine-tuning, (D) embedding time, and (E) impact on FL convergence.
• Employs a reduction-based security analysis to show that the security of the proposed protocols can be built upon the security of underlying watermarking schemes.
• Uses ResNet-50 as the backbone model and evaluates on MNIST, CIFAR10, and CIFAR100 datasets under the PyTorch framework.
• Applies standardized attack models—such as fine-tuning, pruning, and distillation—to assess robustness and covertness across all schemes.
• Employs a formal experiment setup (Algorithm 1) to evaluate covertness via an adversary’s ability to distinguish watermarked from clean models.

Experimental results

Research questions

• RQ1 What new security properties are required for DNN watermarking schemes to support practical ownership verification protocols in real-world settings?
• RQ2 How do existing watermarking schemes perform under the new protocol-specific requirements, particularly in terms of robustness, covertness, and efficiency?
• RQ3 Can the security of the proposed ownership verification protocols be formally reduced to the security of the underlying watermarking schemes?
• RQ4 To what extent do conflicting requirements—such as high watermark capacity versus high model integrity—limit the applicability of current watermarking schemes?
• RQ5 How do different watermarking schemes perform in decentralized environments like federated learning, particularly regarding convergence and model integrity?

Key findings

• MTL-Sign (M-S) achieved the best performance in resisting spoil attacks, with a 0.7% accuracy drop on MNIST and 8.2% on CIFAR100, indicating high resilience to model tampering.
• Uchida’s scheme demonstrated the highest watermark capacity, with a negligible impact on model accuracy (0.1% on MNIST) and a high threshold for successful attacks (≥1,000 iterations).
• Backdoor-based schemes like Rand and WF showed significantly lower watermark capacity (30.2% and 41.3% on MNIST, respectively), indicating vulnerability to high-capacity embedding.
• The embedding time for M-S was the longest (750ms on MNIST), while Uchida’s was the fastest, indicating a trade-off between security and efficiency.
• All schemes had minimal impact on DNN convergence in federated learning (E), with M-S and Uchida’s showing 0.0% and 0.0% impact on CIFAR100, respectively.
• No existing watermarking scheme satisfied all protocol-specific requirements simultaneously, especially under conflicting demands such as high watermark capacity and strong model integrity.